CVE-2023-41217 is a stack-based buffer overflow in the Password field of the SetQuickVPNSettings request in prog.cgi, rated High (CVSS 7.1). It affects D-Link DIR-3040. The vendor fix is v1.20B03 Beta-Hotfix, so update the device and keep its management interface off untrusted networks.
What's affected
The record lists the D-Link DIR-3040 with no firmware range. The D-Link announcement names all A series hardware revisions, US region, on firmware v120B03 and below. The fixed build it names is v1.20B03 Beta-Hotfix, last updated 08/302023 as printed on that page.
Those two version labels look nearly identical, so read the advisory page and the firmware download page for your exact build before you decide a device is patched.
D-Link marks the fix as a beta hotfix. Its page says the build is still undergoing final testing and that you accept the risk of using it. It also says the hotfix was going through full QA and would reach the automatic download server once validated.
This CVE is one of several that the same advisory covers. ZDI tracks it as ZDI-23-1325 (ZDI-CAN-21617).
The NVD record scores it 7.1 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). ZDI gives the same score.
How to check if you're exposed
Start with an inventory. Search your records for the DIR-3040 and note the hardware revision and firmware version for each unit.
Compare each version with the table above. A unit that is below the fixed build, on a network that guests, contractors or other devices can reach, is the first one to fix.
There is no command that works across every environment here, because this is device firmware and not a package you install. The advisory itself gives no scanning command, so use the version check against the vendor table.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers application dependencies, so it will not see embedded device firmware. Track devices like this in your hardware inventory instead.
What to do now
- List every DIR-3040 you run, with its hardware revision and firmware version.
- Download the vendor build (v1.20B03 Beta-Hotfix) from D-Link and read the advisory page first, because the fix is a beta hotfix.
- Schedule the update. Test it on one unit if you can, since D-Link calls the build beta software.
- Move the management interface to a trusted segment and block access from guest and IoT networks.
- If a unit cannot be updated, plan its replacement and keep it isolated until then.
Hardening steps that go beyond the advisory, such as network segmentation, are general practice and not vendor guidance for this CVE.
Why it matters
The weakness class is CWE-121 and CWE-787: a stack-based buffer overflow, which is an out-of-bounds write. The advisory says the length of user-supplied data is not checked before it is copied into a fixed-length stack buffer.
Memory corruption bugs like this in network-facing code tend to come in families, because the same unchecked copy is repeated across parameters. That is why a single advisory lists many CVEs for one product.
This entry covers the Password field of the SetQuickVPNSettings request in prog.cgi. Other CVEs in the same D-Link announcement cover other parameters and handlers, and the single firmware update is what addresses them together. ZDI tracked this one internally as ZDI-CAN-21617.
The record marks it as network-adjacent and needing a low-privilege account with higher attack complexity, which is why the score is 7.1 and not 8.8.
The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read say it is exploited in the wild. That is not a reason to wait, only a note on urgency.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the D-Link fix a final release?
D-Link lists a beta hotfix as the fix and says it is still under testing. Read the advisory page, test the build, and check whether a final release has replaced it.
Does an attacker need to be on my network?
The record marks the attack vector as network-adjacent, so the attacker needs to share a network segment with the device. Segmenting management access reduces that exposure.
Sources
- NVD-derived record data and Safeguard Gold entry for CVE-2023-41217
- Zero Day Initiative advisory ZDI-23-1325
- D-Link security announcement SAP10350
Last reviewed: 19 October 2026.
